sap-ai-dev-toolkit 0.9.9914 → 0.9.9916

package/.github/skills/integration-suite-delivery/SKILL.md

@@ -23,7 +23,7 @@ The Integration Suite companion is never destination-prefixed; its tools are alr
 - APIM products and key value maps: `apim_list_api_products`, `apim_get_api_product`, `apim_create_api_product`, `apim_update_api_product`, `apim_list_key_value_maps`, `apim_get_key_value_map`, `apim_create_key_value_map`, `apim_set_key_value_map_entries`.
 - Anything else (access policies, JMS queues, applications, developers, certificate store references): the read-only `cpi_odata_get` / `apim_odata_get`; start with path `/$metadata` to see the entity sets.
 
-`cpi_*` tools appear only when CPI credentials are configured and `apim_*` tools only when APIM credentials are configured. Start every session with `integration_connection_info` and `verify: true` to see which side is available, which tenant hosts are bound, and which tool areas the service key lacks a role for. When a side is missing or cannot sign in, ask the user to run `sap-ai-dev --setup-integration` in a terminal (paste, online check, user-only storage) instead of pasting a key into the chat.
+`cpi_*` tools appear only when CPI credentials are configured and `apim_*` tools only when APIM credentials are configured. Start every session with `integration_connection_info` and `verify: true` to see which side is available, which tenant hosts are bound, and which tool areas the service key lacks a role for. When a side is missing, cannot sign in, or lacks roles, ask the user to run `sap-ai-dev --setup-integration` in a terminal: it takes the key from the logged-in Cloud Foundry space (and can create a dedicated instance with the needed roles) or from a pasted key, checks it online, and stores it user-only. Never ask for a key in the chat.
 
 ## Exposing an SAP OData service through API Management
 

package/README.md

@@ -232,8 +232,9 @@ Every interactive `sap-ai-dev --setup` asks **"Add the SAP Integration Suite too
 To set up only this server, run **`sap-ai-dev --setup-integration`**. In both routes the credential step:
 
 1. **Checks detected credentials online.** It signs in and runs one read-only request per tool area (packages, deployed artifacts, message logs, security material, number ranges, Partner Directory, data stores, JMS; API proxies, providers, products, key value maps, virtual hosts, and policy readiness, which exports an existing API proxy bundle the way `apim_attach_api_proxy_policies` does). Each area is marked ✓, ✗ (missing role) or – (not available on the tenant or plan, or no proxy exists yet to test the export with).
-2. **Lets you paste a service key.** Paste a CPI key (Process Integration Runtime, plan `api`) or an APIM key (API Management, plan `apiportal-apiaccess`), either as JSON (multi-line paste works; input is hidden) or as the path to the downloaded `.json` file. The key is verified the same way before it is saved.
-3. **Saves only what the server needs.** The URL, token URL, client id and secret go to `~/.config/sap-ai-dev-toolkit/integration-suite.json`, readable only by you. The secret is never printed and never written to `mcp.json`. A key that cannot sign in is saved only if you confirm.
+2. **Uses the logged-in Cloud Foundry space (default when `cf` is logged in).** It finds the Process Integration Runtime instance with plan `api` (`it-rt`) and the API Management instance with plan `apiportal-apiaccess`, lets you choose when there are several, and reuses or creates one service key named `sap-ai-dev-integration` on it. The key is then verified and saved like a pasted one. Roles are fixed on the instance, so when the key signs in but lacks roles, or a side has no instance, the wizard offers to create a dedicated instance (`sap-ai-dev-integration-cpi` with `AuthGroup_Administrator`, `AuthGroup_BusinessExpert`, `AuthGroup_IntegrationDeveloper`, `AuthGroup_TenantPartnerDirectoryConfigurator`, `AccessAllAccessPoliciesArtifacts`; `sap-ai-dev-integration-apim` with `APIPortal.Administrator`). It never does this without your `y`.
+3. **Lets you paste a service key.** Paste a CPI key (Process Integration Runtime, plan `api`) or an APIM key (API Management, plan `apiportal-apiaccess`), either as JSON (multi-line paste works; input is hidden) or as the path to the downloaded `.json` file. The key is verified the same way before it is saved.
+4. **Saves only what the server needs.** The URL, token URL, client id and secret go to `~/.config/sap-ai-dev-toolkit/integration-suite.json`, readable only by you. The secret is never printed and never written to `mcp.json`. A key that cannot sign in is saved only if you confirm.
 
 Environment credentials take precedence over a saved key. Re-check at any time with `sap-ai-integration --check`, or ask the agent to call `integration_connection_info` with `verify: true`. Configure CPI, APIM, or both; per side the first match wins:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.9914",
+  "version": "0.9.9916",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/src/cf-destination.mjs

@@ -26,7 +26,7 @@ function cliError(error) {
   return failure;
 }
 
-async function runCf(args, { env = process.env, execFileImpl = nodeExecFile } = {}) {
+export async function runCf(args, { env = process.env, execFileImpl = nodeExecFile } = {}) {
   try {
     const run = execFileImpl === nodeExecFile ? execFile : promisify(execFileImpl);
     const result = await run('cf', args, {
@@ -86,7 +86,7 @@ export async function getCloudFoundryTarget({ env = process.env, execFileImpl =
   if (!spaceGuid || /\s/.test(spaceGuid)) {
     return { available: false, reason: 'Cloud Foundry CLI is not authenticated to a targeted space; CF destinations were skipped.' };
   }
-  return { available: true, spaceGuid };
+  return { available: true, spaceGuid, spaceName, orgName: /^\s*org:\s*(.*?)\s*$/im.exec(target)?.[1] || '' };
 }
 
 function missingServiceKey(error) {
@@ -159,7 +159,7 @@ export async function findOrphanedCloudFoundryServiceKeys({ env = process.env, s
   return orphans;
 }
 
-async function cfJson(path, options) {
+export async function cfJson(path, options) {
   const value = await runCf(['curl', path], options);
   try {
     return JSON.parse(value);
@@ -177,7 +177,7 @@ function apiPath(href) {
   }
 }
 
-async function serviceInstances(spaceGuid, options) {
+export async function serviceInstances(spaceGuid, options) {
   const instances = [];
   let path = `/v3/service_instances?space_guids=${encodeURIComponent(spaceGuid)}&per_page=500`;
   const visited = new Set();
@@ -398,7 +398,7 @@ async function readServiceKey(instance, kind, spaceGuid, managedKeys, createdKey
   return { keyName, credentials };
 }
 
-async function serviceKeyCredentials(instanceName, keyName, kind, options) {
+export async function serviceKeyCredentials(instanceName, keyName, kind, options) {
   const raw = await runCf(['service-key', '--json', instanceName, keyName], options);
   let parsed;
   try {

package/src/cf-integration.mjs

@@ -0,0 +1,74 @@
+// Integration Suite credentials from the logged-in Cloud Foundry space: find the Process Integration
+// Runtime (plan api) and API Management (plan apiportal-apiaccess) instances, reuse or create one
+// named service key per instance, and optionally create a dedicated instance with the roles the tools need.
+import { execFile as nodeExecFile } from 'node:child_process';
+import { cfJson, runCf, serviceInstances, serviceKeyCredentials } from './cf-destination.mjs';
+
+// Not the toolkit's destination-key prefix: the destination orphan sweep must not offer to delete these keys.
+export const INTEGRATION_KEY_NAME = 'sap-ai-dev-integration';
+
+export const INTEGRATION_CF_SERVICES = Object.freeze({
+  CPI: Object.freeze({
+    offering: 'it-rt',
+    plan: 'api',
+    label: 'Process Integration Runtime',
+    dedicatedInstance: 'sap-ai-dev-integration-cpi',
+    // Role templates of the Cloud Integration API plan covering design, deployment, monitoring,
+    // security material and Partner Directory work done by the cpi_* tools.
+    parameters: Object.freeze({
+      'grant-types': ['client_credentials'],
+      'redirect-uris': [],
+      roles: ['AuthGroup_Administrator', 'AuthGroup_BusinessExpert', 'AuthGroup_IntegrationDeveloper', 'AuthGroup_TenantPartnerDirectoryConfigurator', 'AccessAllAccessPoliciesArtifacts']
+    })
+  }),
+  APIM: Object.freeze({
+    offering: 'apimanagement-apiportal',
+    plan: 'apiportal-apiaccess',
+    label: 'API Management, API portal',
+    dedicatedInstance: 'sap-ai-dev-integration-apim',
+    parameters: Object.freeze({ role: 'APIPortal.Administrator' })
+  })
+});
+
+/** Integration Suite instances in the space, by side: { CPI: [{ guid, name }], APIM: [...] }. */
+export async function findIntegrationInstances({ env = process.env, spaceGuid, execFileImpl = nodeExecFile } = {}) {
+  const options = { env, execFileImpl };
+  const plans = new Map();
+  const found = { CPI: [], APIM: [] };
+  for (const instance of await serviceInstances(spaceGuid, options)) {
+    const planGuid = instance?.relationships?.service_plan?.data?.guid;
+    if (!planGuid || !instance?.name) continue;
+    if (!plans.has(planGuid)) {
+      try {
+        const plan = await cfJson(`/v3/service_plans/${encodeURIComponent(planGuid)}?include=service_offering`, options);
+        plans.set(planGuid, { plan: plan?.name, offering: plan?.included?.service_offerings?.[0]?.name });
+      } catch {
+        plans.set(planGuid, {});
+      }
+    }
+    const { plan, offering } = plans.get(planGuid);
+    for (const [side, service] of Object.entries(INTEGRATION_CF_SERVICES)) {
+      if (offering === service.offering && plan === service.plan) found[side].push({ guid: String(instance.guid), name: String(instance.name) });
+    }
+  }
+  return found;
+}
+
+/** Credentials of the toolkit's service key on an instance; the key is created when it does not exist yet. */
+export async function integrationServiceKey(instanceName, { env = process.env, execFileImpl = nodeExecFile } = {}) {
+  const options = { env, execFileImpl };
+  try {
+    return { keyName: INTEGRATION_KEY_NAME, created: false, credentials: await serviceKeyCredentials(instanceName, INTEGRATION_KEY_NAME, 'Integration Suite', options) };
+  } catch {
+    // No readable key of that name yet.
+  }
+  await runCf(['create-service-key', instanceName, INTEGRATION_KEY_NAME, '--wait'], options);
+  return { keyName: INTEGRATION_KEY_NAME, created: true, credentials: await serviceKeyCredentials(instanceName, INTEGRATION_KEY_NAME, 'Integration Suite', options) };
+}
+
+/** Create the dedicated instance for a side with the roles the tools need; returns { guid?, name }. */
+export async function createIntegrationInstance(side, { env = process.env, execFileImpl = nodeExecFile } = {}) {
+  const service = INTEGRATION_CF_SERVICES[side];
+  await runCf(['create-service', service.offering, service.plan, service.dedicatedInstance, '-c', JSON.stringify(service.parameters), '--wait'], { env, execFileImpl });
+  return { name: service.dedicatedInstance };
+}

package/src/integration-http.mjs

@@ -80,6 +80,22 @@ function setCookiePairs(headers) {
   return values.map(value => value.split(';')[0].trim()).filter(Boolean);
 }
 
+// undici flags EnvHttpProxyAgent as experimental with a process warning that lands in the middle of the
+// setup wizard output; only that warning is dropped, and only while the agent is constructed.
+function envProxyAgent(options) {
+  const emitWarning = process.emitWarning;
+  process.emitWarning = (warning, ...rest) => {
+    const code = typeof rest[0] === 'object' ? rest[0]?.code : rest[1];
+    if (code === 'UNDICI-EHPA') return;
+    emitWarning.call(process, warning, ...rest);
+  };
+  try {
+    return new EnvHttpProxyAgent(options);
+  } finally {
+    process.emitWarning = emitWarning;
+  }
+}
+
 /** Create a tenant-scoped client using OAuth client credentials. */
 export function createServiceClient({
   label,
@@ -97,7 +113,7 @@ export function createServiceClient({
   const httpProxy = env.HTTP_PROXY || env.http_proxy;
   const httpsProxy = env.HTTPS_PROXY || env.https_proxy;
   const dispatcher = httpProxy || httpsProxy
-    ? new EnvHttpProxyAgent({ httpProxy, httpsProxy, noProxy: env.NO_PROXY || env.no_proxy })
+    ? envProxyAgent({ httpProxy, httpsProxy, noProxy: env.NO_PROXY || env.no_proxy })
     : undefined;
   const transportOptions = dispatcher ? { dispatcher } : {};
   let cachedToken = null;

package/src/integration-verify.mjs

@@ -109,7 +109,7 @@ export async function verifyIntegrationClients({ cpi, apim } = {}) {
 export function verificationLines(label, host, side) {
   if (!side?.configured) return [];
   if (!side.signed_in) return [`✗ ${label} ${host}: sign-in failed — ${side.error}`];
-  const lines = [`${side.ok ? '✓' : '✗'} ${label} ${host}: signed in`];
+  const lines = [side.ok ? `✓ ${label} ${host}: signed in` : `✗ ${label} ${host}: signed in, but ${side.checks[0]?.area ?? 'the core area'} is not readable with this key`];
   for (const check of side.checks) {
     const mark = check.result === 'ok' ? '✓' : (check.result === 'unavailable' ? '–' : '✗');
     lines.push(`    ${mark} ${check.area}${check.result === 'ok' ? '' : ` — ${check.detail}`}`);

package/src/setup.mjs

@@ -10,6 +10,7 @@ import { discoverCloudFoundryDestinations, getCloudFoundryTarget, deleteManagedC
 import { SAP_DEVELOPMENT_MCP_SERVERS, collectCloudFoundryKeyReferencesFromAllEntries, collectManagedCloudFoundryKeyReferences, installMcpConfig, readMcpConfig, resolveMcpConfigPath } from './mcp-config.mjs';
 import { parseIntegrationServiceKey, resolveIntegrationConfig, resolveIntegrationSideFromEnvironment } from './integration-config.mjs';
 import { readStoredIntegrationKeys, storeIntegrationKey } from './integration-credentials.mjs';
+import { INTEGRATION_CF_SERVICES, createIntegrationInstance, findIntegrationInstances, integrationServiceKey } from './cf-integration.mjs';
 import { createIntegrationClients, verificationLines, verifyIntegrationClients } from './integration-verify.mjs';
 import { discoverCertificateDnsNames } from './tls-adt-proxy.mjs';
 import { findRemoteControllableSsoBrowsers } from './sso-browsers.mjs';
@@ -331,23 +332,165 @@ async function printIntegrationVerification(config, { env, output, verifyIntegra
   if (report.ok) {
     print(output, formatStatus(`Integration Suite credentials verified${missing ? `; ${missing} area${missing === 1 ? ' needs' : 's need'} an extra role on the service key` : ''}.`, missing ? 'warning' : 'success', output, 'Integration Suite'));
   } else {
-    print(output, formatStatus('Integration Suite verification failed; fix or replace the service key before using the tools.', 'warning', output, 'Integration Suite'));
+    const signedIn = [report.cpi, report.apim].some(side => side?.signed_in);
+    print(output, formatStatus(signedIn
+      ? 'The key signs in but lacks the roles for the core area; use an instance with the needed roles (the Cloud Foundry option can create one) or replace the key.'
+      : 'Integration Suite sign-in failed; fix or replace the service key before using the tools.', 'warning', output, 'Integration Suite'));
   }
   return report;
 }
 
-// Verify the detected credentials online and let the user paste CPI/APIM service keys. A pasted key is checked
-// online first and saved to the user-only store (never to mcp.json); it is used when the environment has no key.
-async function configureIntegrationCredentials({ env, input, output, verifyIntegration }) {
+const defaultIntegrationCloudFoundry = Object.freeze({
+  getTarget: getCloudFoundryTarget,
+  findInstances: findIntegrationInstances,
+  serviceKey: integrationServiceKey,
+  createInstance: createIntegrationInstance
+});
+
+const SIDE_LABELS = Object.freeze({ CPI: 'Cloud Integration (CPI)', APIM: 'API Management' });
+
+function cfFailure(error) {
+  const detail = String(error?.stderr || error?.message || '').replace(/\s+/g, ' ').trim();
+  return detail ? detail.slice(0, 300) : 'Cloud Foundry CLI command failed';
+}
+
+// Verify one side's key online, then save it user-only. A key that cannot sign in is saved only when confirmed.
+async function acceptIntegrationKey(side, config, context) {
+  const { env, input, output, verifyIntegration } = context;
+  const choice = side.toLowerCase();
+  const report = await printIntegrationVerification({ [choice]: config }, { env, output, verifyIntegration });
+  if (!report[choice].signed_in && !await confirmPrompt('Save this key anyway? (y/n, Enter=no)', { input, output, defaultYes: false })) return { saved: false, report };
+  const path = await storeIntegrationKey(side, config, env);
+  print(output, formatStatus(`Saved the ${side} key to ${path} (readable only by you; not written to mcp.json).`, 'success', output, 'Integration Suite'));
+  let fromEnvironment = null;
+  try {
+    fromEnvironment = resolveIntegrationSideFromEnvironment(env, side);
+  } catch {
+    // A broken environment value is reported by the status lines.
+  }
+  if (fromEnvironment) print(output, formatStatus(`${side} credentials from ${fromEnvironment.source} in this environment take precedence over the saved key.`, 'warning', output, 'Integration Suite'));
+  context.recordHealth?.(report);
+  return { saved: true, report };
+}
+
+function lacksRoles(side) {
+  return Boolean(side?.signed_in) && (!side.ok || side.checks.some(check => check.result === 'forbidden'));
+}
+
+async function cloudFoundryStep(message, operation, { env, output }) {
+  const stop = startProgress(message, { output, env, label: 'Cloud Foundry' });
+  try {
+    return await operation();
+  } finally {
+    stop();
+  }
+}
+
+// Key from an instance: reuse or create the toolkit's service key, then verify and save it.
+async function useCloudFoundryInstance(side, instanceName, context) {
+  const { env, output, cloudFoundry } = context;
+  const key = await cloudFoundryStep(`Reading service key ${instanceName}/sap-ai-dev-integration`, () => cloudFoundry.serviceKey(instanceName, { env }), context);
+  print(output, formatStatus(`${key.created ? 'Created' : 'Reusing'} service key ${key.keyName} on ${instanceName}.`, 'info', output, 'Cloud Foundry'));
+  return acceptIntegrationKey(side, parseIntegrationServiceKey(side, key.credentials), context);
+}
+
+async function createDedicatedInstance(side, context) {
+  const { env, output, cloudFoundry } = context;
+  const service = INTEGRATION_CF_SERVICES[side];
+  try {
+    await cloudFoundryStep(`Creating ${service.offering}/${service.plan} instance ${service.dedicatedInstance}`, () => cloudFoundry.createInstance(side, { env }), context);
+  } catch (error) {
+    print(output, formatStatus(`Could not create ${service.dedicatedInstance}: ${cfFailure(error)}`, 'warning', output, 'Cloud Foundry'));
+    return null;
+  }
+  print(output, formatStatus(`Created service instance ${service.dedicatedInstance}.`, 'success', output, 'Cloud Foundry'));
+  return useCloudFoundryInstance(side, service.dedicatedInstance, context);
+}
+
+// Use the logged-in CF space: per side pick the matching instance (or offer to create a dedicated one with the
+// roles the tools need), reuse or create the toolkit's service key, verify it online and save it.
+async function useCloudFoundrySpace(target, context) {
+  const { env, input, output, cloudFoundry } = context;
+  let instances;
+  try {
+    instances = await cloudFoundryStep('Looking for Integration Suite service instances in the CF space', () => cloudFoundry.findInstances({ env, spaceGuid: target.spaceGuid }), context);
+  } catch (error) {
+    print(output, formatStatus(`Could not list service instances: ${cfFailure(error)}`, 'warning', output, 'Cloud Foundry'));
+    return;
+  }
+  for (const side of ['CPI', 'APIM']) {
+    const service = INTEGRATION_CF_SERVICES[side];
+    const candidates = instances[side] || [];
+    print(output, '');
+    if (!candidates.length) {
+      print(output, formatStatus(`No ${service.label} instance with plan ${service.plan} (${service.offering}) in this space.`, 'info', output, SIDE_LABELS[side]));
+      if (await confirmPrompt(`Create instance ${service.dedicatedInstance} (${service.offering}, plan ${service.plan}) with the roles the tools need? (y/n, Enter=no)`, { input, output, defaultYes: false })) {
+        await createDedicatedInstance(side, context);
+      }
+      continue;
+    }
+    const dedicated = candidates.find(candidate => candidate.name === service.dedicatedInstance);
+    const instanceName = candidates.length === 1 ? candidates[0].name : await selectPrompt({
+      message: colorText(`☁️ ${SIDE_LABELS[side]}: choose the ${service.offering}/${service.plan} instance to use`, 'cyan', output),
+      defaultValue: (dedicated || candidates[0]).name,
+      choices: [...candidates.map(candidate => ({ name: candidate.name, value: candidate.name })), { name: 'Skip', value: '', shortcut: 's' }]
+    }, { input, output });
+    if (!instanceName) continue;
+    let result;
+    try {
+      result = await useCloudFoundryInstance(side, instanceName, context);
+    } catch (error) {
+      print(output, formatStatus(`Could not use ${instanceName}: ${cfFailure(error)}`, 'warning', output, SIDE_LABELS[side]));
+      continue;
+    }
+    const sideReport = result.report[side.toLowerCase()];
+    if (instanceName !== service.dedicatedInstance && !dedicated && lacksRoles(sideReport)) {
+      print(output, `  The roles of ${instanceName} are fixed on the instance; a new key cannot add them.`);
+      print(output, `  A dedicated instance gets: ${service.parameters.roles ? service.parameters.roles.join(', ') : service.parameters.role}.`);
+      if (await confirmPrompt(`Create instance ${service.dedicatedInstance} with these roles and use it instead? (y/n, Enter=no)`, { input, output, defaultYes: false })) {
+        await createDedicatedInstance(side, context);
+      }
+    }
+  }
+}
+
+// Verify the detected credentials online and let the user take CPI/APIM keys from the logged-in CF space or
+// paste them. A key is checked online first and saved to the user-only store (never to mcp.json); it is used
+// when the environment has no key.
+async function configureIntegrationCredentials({ env, input, output, verifyIntegration, cloudFoundry = defaultIntegrationCloudFoundry }) {
   let status = integrationSuiteCredentialStatus(env);
-  if (status.found) await printIntegrationVerification(status.config, { env, output, verifyIntegration });
+  // Latest verification per side ({ cpi, apim }); updated whenever a key is checked or saved.
+  const health = {};
+  const recordHealth = report => {
+    for (const side of ['cpi', 'apim']) if (report?.[side]?.configured) health[side] = report[side];
+  };
+  if (status.found) recordHealth(await printIntegrationVerification(status.config, { env, output, verifyIntegration }));
+  let target = { available: false };
+  try {
+    target = await cloudFoundryStep('Checking the Cloud Foundry login', () => cloudFoundry.getTarget({ env }), { env, output });
+  } catch {
+    // No CF CLI or no login: the CF option is simply not offered.
+  }
+  const context = { env, input, output, verifyIntegration, cloudFoundry, recordHealth };
   for (;;) {
     print(output, '');
+    const space = target.available ? [target.orgName, target.spaceName].filter(Boolean).join(' / ') || target.spaceGuid : '';
+    // Sides whose key signs in but lacks roles: a new key cannot fix that, a dedicated instance can.
+    const roleless = ['CPI', 'APIM'].filter(side => lacksRoles(health[side.toLowerCase()]));
+    const healthy = status.found && !roleless.length && Object.values(health).every(side => side.ok);
+    const fixes = target.available
+      ? roleless.map(side => ({
+        name: `Create ${INTEGRATION_CF_SERVICES[side].dedicatedInstance} in ${space} with the roles the ${side} tools need, then use it`,
+        value: `create-${side.toLowerCase()}`
+      }))
+      : [];
     const choice = await selectPrompt({
       message: colorText('🔑 Integration Suite credentials', 'cyan', output),
-      defaultValue: status.found ? 'done' : 'cpi',
+      defaultValue: healthy ? 'done' : (fixes[0]?.value ?? (target.available ? 'cf' : (status.found ? 'done' : 'cpi'))),
       choices: [
-        { name: status.found ? 'Continue' : 'Continue without credentials (the server will not start until a key is configured)', value: 'done', shortcut: 'c' },
+        ...fixes,
+        { name: !status.found ? 'Continue without credentials (the server will not start until a key is configured)' : (healthy ? 'Continue' : 'Continue with the current key (tools in the ✗ areas will fail with HTTP 403)'), value: 'done', shortcut: 'c' },
+        ...(target.available ? [{ name: `Use the logged-in CF space (${space}): find instances, reuse or create keys`, value: 'cf', shortcut: 'f' }] : []),
         { name: 'Paste a Cloud Integration (CPI) service key — Process Integration Runtime, plan api', value: 'cpi', shortcut: 'p' },
         { name: 'Paste an API Management service key — API Management, plan apiportal-apiaccess', value: 'apim', shortcut: 'a' },
         ...(status.found ? [{ name: 'Check the configured credentials online again', value: 'verify', shortcut: 'v' }] : [])
@@ -355,40 +498,35 @@ async function configureIntegrationCredentials({ env, input, output, verifyInteg
     }, { input, output });
     if (choice === 'done') return status;
     if (choice === 'verify') {
-      await printIntegrationVerification(status.config, { env, output, verifyIntegration });
+      recordHealth(await printIntegrationVerification(status.config, { env, output, verifyIntegration }));
       continue;
     }
-    const side = choice.toUpperCase();
-    const pasted = await textPrompt({
-      message: `Paste the ${side} service key JSON or the path to its .json file`,
-      secret: true,
-      validate: value => {
-        try {
-          pastedServiceKey(side, value, env);
-          return true;
-        } catch (error) {
-          return error.message;
+    if (choice.startsWith('create-')) {
+      await createDedicatedInstance(choice.slice('create-'.length).toUpperCase(), context);
+    } else if (choice === 'cf') {
+      await useCloudFoundrySpace(target, context);
+    } else {
+      const side = choice.toUpperCase();
+      const pasted = await textPrompt({
+        message: `Paste the ${side} service key JSON or the path to its .json file`,
+        secret: true,
+        validate: value => {
+          try {
+            pastedServiceKey(side, value, env);
+            return true;
+          } catch (error) {
+            return error.message;
+          }
         }
-      }
-    }, { input, output });
-    const config = pastedServiceKey(side, pasted, env);
-    const report = await printIntegrationVerification({ [choice]: config }, { env, output, verifyIntegration });
-    if (!report[choice].signed_in && !await confirmPrompt('Save this key anyway? (y/n, Enter=no)', { input, output, defaultYes: false })) continue;
-    const path = await storeIntegrationKey(side, config, env);
-    print(output, formatStatus(`Saved the ${side} key to ${path} (readable only by you; not written to mcp.json).`, 'success', output, 'Integration Suite'));
-    let fromEnvironment = null;
-    try {
-      fromEnvironment = resolveIntegrationSideFromEnvironment(env, side);
-    } catch {
-      // A broken environment value is reported by the status lines below.
+      }, { input, output });
+      await acceptIntegrationKey(side, pastedServiceKey(side, pasted, env), context);
     }
-    if (fromEnvironment) print(output, formatStatus(`${side} credentials from ${fromEnvironment.source} in this environment take precedence over the saved key.`, 'warning', output, 'Integration Suite'));
     status = integrationSuiteCredentialStatus(env);
     for (const line of status.lines) print(output, `  ${line}`);
   }
 }
 
-async function promptIntegrationSuite({ env, alreadyConfigured, input, output, verifyIntegration = defaultVerifyIntegration, ask = true }) {
+async function promptIntegrationSuite({ env, alreadyConfigured, input, output, verifyIntegration = defaultVerifyIntegration, integrationCloudFoundry, ask = true }) {
   print(output, '');
   print(output, formatStatus('SAP Integration Suite tools (Cloud Integration + API Management).', 'step', output, 'Integration Suite'));
   print(output, '  Adds the sap-ai-integration MCP server: iFlows, value mappings, security material and monitoring in CPI; API providers, proxies, policies, products and key value maps in APIM.');
@@ -405,7 +543,7 @@ async function promptIntegrationSuite({ env, alreadyConfigured, input, output, v
     const defaultYes = status.found;
     if (!await confirmPrompt(`Add the SAP Integration Suite tools? (y/n, Enter=${defaultYes ? 'yes' : 'no'})`, { input, output, defaultYes })) return false;
   }
-  await configureIntegrationCredentials({ env, input, output, verifyIntegration });
+  await configureIntegrationCredentials({ env, input, output, verifyIntegration, ...(integrationCloudFoundry ? { cloudFoundry: integrationCloudFoundry } : {}) });
   return true;
 }
 
@@ -415,7 +553,8 @@ export async function runIntegrationSuiteSetup({
   input = stdin,
   output = stdout,
   install = installMcpConfig,
-  verifyIntegration = defaultVerifyIntegration
+  verifyIntegration = defaultVerifyIntegration,
+  integrationCloudFoundry
 } = {}) {
   if (!input.isTTY || !output.isTTY) {
     print(output, formatStatus('Interactive setup needs a terminal. Rerun sap-ai-dev --setup-integration from a terminal.', 'warning', output, 'SAP AI Dev Toolkit'));
@@ -427,7 +566,7 @@ export async function runIntegrationSuiteSetup({
   } catch {
     // A missing or unreadable config is created or healed by install.
   }
-  await promptIntegrationSuite({ env, alreadyConfigured, input, output, verifyIntegration, ask: false });
+  await promptIntegrationSuite({ env, alreadyConfigured, input, output, verifyIntegration, integrationCloudFoundry, ask: false });
   const result = await install([], { env, sapDevelopmentServers: ['integration-suite'], additive: true });
   print(output, '');
   print(output, formatStatus(`Configured the Integration Suite MCP server${result?.path ? ` in ${result.path}` : ''}.`, 'success', output, 'Integration Suite'));
@@ -771,7 +910,8 @@ export async function runSetup({
   includeSapDevelopmentToolsPrompt = false,
   detectAdtUrl,
   discoverSsoBrowsers = findRemoteControllableSsoBrowsers,
-  verifyIntegration = defaultVerifyIntegration
+  verifyIntegration = defaultVerifyIntegration,
+  integrationCloudFoundry
 } = {}) {
   const isBas = Boolean(env.H2O_URL);
   if (!isBas && (!input.isTTY || !output.isTTY)) {
@@ -943,7 +1083,7 @@ export async function runSetup({
 
   let sapDevelopmentServers = [];
   if (integrationOnly) {
-    await promptIntegrationSuite({ env, alreadyConfigured: integrationSuiteConfigured, input, output, verifyIntegration, ask: false });
+    await promptIntegrationSuite({ env, alreadyConfigured: integrationSuiteConfigured, input, output, verifyIntegration, integrationCloudFoundry, ask: false });
     sapDevelopmentServers = ['integration-suite'];
   } else if (includeSapDevelopmentToolsPrompt) {
     print(output, '');
@@ -963,9 +1103,9 @@ export async function runSetup({
       shortcuts: { all: 'a' }
     }, { input, output });
     if (sapDevelopmentServers.includes('integration-suite')) {
-      await promptIntegrationSuite({ env, alreadyConfigured: integrationSuiteConfigured, input, output, verifyIntegration, ask: false });
+      await promptIntegrationSuite({ env, alreadyConfigured: integrationSuiteConfigured, input, output, verifyIntegration, integrationCloudFoundry, ask: false });
     }
-  } else if (await promptIntegrationSuite({ env, alreadyConfigured: integrationSuiteConfigured, input, output, verifyIntegration })) {
+  } else if (await promptIntegrationSuite({ env, alreadyConfigured: integrationSuiteConfigured, input, output, verifyIntegration, integrationCloudFoundry })) {
     // Without --tools, Integration Suite still gets its own yes/no step instead of being hidden.
     sapDevelopmentServers = ['integration-suite'];
   }